Study: Thermal Imaging Could Be Used to Hack ATM Codes

It sounds like something from an adrenaline-pumping spy thriller. You know, like Spy Kids 3-D.

A new study from researchers at the University of California, San Diego, posits that thermal imaging cameras can be used to capture the residual heat left over from freshly pressed ATM keys. This strategy in particular holds one pretty compelling advantage over traditional cameras that have been used by thieves before: It can be used after you leave.

The study, conducted by Keaton Mowery, Sarah Meiklejohn and Stefan Savage (which you can read in its entirety here in PDF form), took a look at two different types of ATM keypads: one with rubber keys and one with metal. They then had codes pressed into the ATM before moving in with a thermal imaging camera.

From there, they were able to determine which four keys on the rubber pad were actually pressed. Take a look at the photo above: The ‘1’ and ‘4’ keys have heat spots that are distinctively smaller, hinting that they were most likely pressed before the ‘5’ or ‘8’. The researchers were able to obtain meaningful combinations using the camera 80 percent of the time after 10 seconds, while after a minute the success rate dropped to 60% percent. After 90 seconds, it was somewhere around 20% (so take your time).

However, there were a few hiccups. The researchers had trouble getting the metal keypad to show up properly under the scope, which they suggest is likely due to the metal’s “high thermal conductivity.”

But if you’re worried about sophisticated thieves cracking your ATM code with heat vision, don’t sweat it: The camera itself costs an absurd $17,950 (or a more paltry $1,950 to rent). What’s more, it required a cumbersome tripod and a host of other controlled factors to be set up just right.

And when you think about it, ATM navigation is more than just your pin code alone (like when you input your withdrawal amount, for example), further confounding high tech thieves. Also, the study found that people press keys with different amounts of pressure, and obviously users with lighter fingers were harder to detect.

Plus, as one researcher tells Technology Review, “Miniature daylight cameras are a lot simpler and more reliable.” He adds: “So is mugging.”

Still, if you’re worried about someone going all Splinter Cell on your cash stash, just press a bunch of buttons before you leave. Problem solved.